Linux kernel (drivers/vfio): A blocked migration-state transition makes the vfio state machine spin forever while

Impact

A blocked migration-state transition makes the vfio state machine spin forever while holding the driver's state mutex. The calling thread never returns, a CPU is pinned in kernel mode, and on a node booted with softlockup_panic the box panics outright - one ioctl from one tenant is a noisy-neighbour outage for everyone else on the node.

Who can reach it

A tenant holding /dev/vfio/* for a migration-capable device issues VFIO_DEVICE_FEATURE with MIG_DEVICE_STATE requesting the blocked STOP_COPY to PRE_COPY (or PRE_COPY_P2P) transition. Conditional on a vfio variant driver that advertises precopy - mlx5 VFs, Intel Xe and QAT VFs and similar - being bound to the tenant's device. No host privilege needed.

What to do

Update to a stable kernel carrying commits 8e872c07 / ed7d5599. Interim: bind tenant devices to plain vfio-pci rather than a migration-capable variant driver where you do not need live migration, and do not boot tenant nodes with softlockup_panic.

References